REvil Ransomware Automates File Encryption in Safe Mode After Changing Windows Passwords
It is believed that this mode was added as a way to evade detection by security software and to shut down backup software, database servers, or mail servers to have greater success in file encryption.
